mirror of
https://github.com/github/codeql.git
synced 2026-05-14 11:19:27 +02:00
Replace fluent SSRF changes with Apache HttpClient execute model tests
Agent-Logs-Url: https://github.com/github/codeql/sessions/3db201db-a1b5-4353-a94a-14a8d156dd3b Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot]
committed by
GitHub
GitHub
parent
f5b17b0b48
commit
043ec857ab
@@ -3,6 +3,11 @@ extensions:
|
||||
pack: codeql/java-all
|
||||
extensible: sinkModel
|
||||
data:
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,ResponseHandler,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,ResponseHandler)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpHost,HttpRequest,ResponseHandler,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,ResponseHandler)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
- ["org.apache.http.client", "HttpClient", True, "execute", "(HttpUriRequest,ResponseHandler,HttpContext)", "", "Argument[0]", "request-forgery", "ai-manual"]
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
import java.io.IOException;
|
||||
|
||||
import org.apache.http.HttpHost;
|
||||
import org.apache.http.HttpRequest;
|
||||
import org.apache.http.client.HttpClient;
|
||||
import org.apache.http.client.ResponseHandler;
|
||||
import org.apache.http.client.methods.HttpUriRequest;
|
||||
import org.apache.http.message.BasicHttpRequest;
|
||||
import org.apache.http.protocol.HttpContext;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
public class ApacheHttpClientExecuteSSRF extends HttpServlet {
|
||||
|
||||
protected void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
try {
|
||||
|
||||
String sink = request.getParameter("host"); // $ Source
|
||||
|
||||
HttpHost host = new HttpHost(sink);
|
||||
HttpRequest req = new BasicHttpRequest("GET", "/");
|
||||
HttpUriRequest uriReq = (HttpUriRequest) (Object) sink;
|
||||
HttpContext context = null;
|
||||
HttpClient client = null;
|
||||
ResponseHandler<Object> handler = null;
|
||||
|
||||
client.execute(host, req); // $ Alert
|
||||
client.execute(host, req, context); // $ Alert
|
||||
client.execute(host, req, handler); // $ Alert
|
||||
client.execute(host, req, handler, context); // $ Alert
|
||||
client.execute(uriReq); // $ Alert
|
||||
client.execute(uriReq, context); // $ Alert
|
||||
client.execute(uriReq, handler); // $ Alert
|
||||
client.execute(uriReq, handler, context); // $ Alert
|
||||
|
||||
} catch (Exception e) {
|
||||
// TODO: handle exception
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,40 +0,0 @@
|
||||
import java.io.IOException;
|
||||
import java.net.URI;
|
||||
|
||||
import org.apache.http.client.fluent.Request;
|
||||
import javax.servlet.ServletException;
|
||||
import javax.servlet.http.HttpServlet;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import javax.servlet.http.HttpServletResponse;
|
||||
|
||||
public class ApacheHttpFluentSSRF extends HttpServlet {
|
||||
|
||||
protected void doGet(HttpServletRequest request, HttpServletResponse response)
|
||||
throws ServletException, IOException {
|
||||
try {
|
||||
|
||||
String sink = request.getParameter("uri"); // $ Source
|
||||
URI uri = new URI(sink);
|
||||
|
||||
Request.Delete(sink); // $ Alert
|
||||
Request.Delete(uri); // $ Alert
|
||||
Request.Get(sink); // $ Alert
|
||||
Request.Get(uri); // $ Alert
|
||||
Request.Head(sink); // $ Alert
|
||||
Request.Head(uri); // $ Alert
|
||||
Request.Options(sink); // $ Alert
|
||||
Request.Options(uri); // $ Alert
|
||||
Request.Patch(sink); // $ Alert
|
||||
Request.Patch(uri); // $ Alert
|
||||
Request.Post(sink); // $ Alert
|
||||
Request.Post(uri); // $ Alert
|
||||
Request.Put(sink); // $ Alert
|
||||
Request.Put(uri); // $ Alert
|
||||
Request.Trace(sink); // $ Alert
|
||||
Request.Trace(uri); // $ Alert
|
||||
|
||||
} catch (Exception e) {
|
||||
// TODO: handle exception
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1 +1 @@
|
||||
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/javax-validation-constraints:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/apache-http-fluent-4.5.14:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf
|
||||
//semmle-extractor-options: --javac-args -source 11 -target 11 -cp ${testdir}/../../../stubs/javax-validation-constraints:${testdir}/../../../stubs/springframework-5.8.x:${testdir}/../../../stubs/javax-ws-rs-api-2.1.1:${testdir}/../../../stubs/javax-ws-rs-api-3.0.0:${testdir}/../../../stubs/apache-http-4.4.13/:${testdir}/../../../stubs/apache-http-client-4.4.13:${testdir}/../../../stubs/projectreactor-3.4.3/:${testdir}/../../../stubs/postgresql-42.3.3/:${testdir}/../../../stubs/HikariCP-3.4.5/:${testdir}/../../../stubs/spring-jdbc-5.3.8/:${testdir}/../../../stubs/jdbi3-core-3.27.2/:${testdir}/../../../stubs/cargo:${testdir}/../../../stubs/javafx-web:${testdir}/../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../stubs/dom4j-2.1.1:${testdir}/../../../stubs/jaxen-1.2.0:${testdir}/../../../stubs/stapler-1.263:${testdir}/../../../stubs/javax-servlet-2.5:${testdir}/../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../stubs/saxon-xqj-9.x:${testdir}/../../../stubs/apache-commons-beanutils:${testdir}/../../../stubs/apache-commons-lang:${testdir}/../../../stubs/apache-http-5:${testdir}/../../../stubs/playframework-2.6.x:${testdir}/../../../stubs/jaxws-api-2.0:${testdir}/../../../stubs/apache-cxf
|
||||
|
||||
23
java/ql/test/stubs/apache-http-client-4.4.13/org/apache/http/client/HttpClient.java
generated
Normal file
23
java/ql/test/stubs/apache-http-client-4.4.13/org/apache/http/client/HttpClient.java
generated
Normal file
@@ -0,0 +1,23 @@
|
||||
// Generated automatically from org.apache.http.client.HttpClient for testing purposes
|
||||
|
||||
package org.apache.http.client;
|
||||
|
||||
import java.io.IOException;
|
||||
import org.apache.http.HttpHost;
|
||||
import org.apache.http.HttpRequest;
|
||||
import org.apache.http.HttpResponse;
|
||||
import org.apache.http.client.methods.HttpUriRequest;
|
||||
import org.apache.http.protocol.HttpContext;
|
||||
|
||||
public interface HttpClient {
|
||||
HttpResponse execute(HttpHost target, HttpRequest request) throws IOException;
|
||||
HttpResponse execute(HttpHost target, HttpRequest request, HttpContext context) throws IOException;
|
||||
<T> T execute(HttpHost target, HttpRequest request, ResponseHandler<? extends T> responseHandler) throws IOException;
|
||||
<T> T execute(HttpHost target, HttpRequest request, ResponseHandler<? extends T> responseHandler, HttpContext context)
|
||||
throws IOException;
|
||||
HttpResponse execute(HttpUriRequest request) throws IOException;
|
||||
HttpResponse execute(HttpUriRequest request, HttpContext context) throws IOException;
|
||||
<T> T execute(HttpUriRequest request, ResponseHandler<? extends T> responseHandler) throws IOException;
|
||||
<T> T execute(HttpUriRequest request, ResponseHandler<? extends T> responseHandler, HttpContext context)
|
||||
throws IOException;
|
||||
}
|
||||
9
java/ql/test/stubs/apache-http-client-4.4.13/org/apache/http/client/ResponseHandler.java
generated
Normal file
9
java/ql/test/stubs/apache-http-client-4.4.13/org/apache/http/client/ResponseHandler.java
generated
Normal file
@@ -0,0 +1,9 @@
|
||||
// Generated automatically from org.apache.http.client.ResponseHandler for testing purposes
|
||||
|
||||
package org.apache.http.client;
|
||||
|
||||
import org.apache.http.HttpResponse;
|
||||
|
||||
public interface ResponseHandler<T> {
|
||||
T handleResponse(HttpResponse response);
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
// Generated automatically from org.apache.http.client.fluent.Request for testing purposes
|
||||
|
||||
package org.apache.http.client.fluent;
|
||||
|
||||
import java.net.URI;
|
||||
|
||||
public class Request {
|
||||
protected Request() {}
|
||||
|
||||
public static Request Delete(String p0) { return null; }
|
||||
public static Request Delete(URI p0) { return null; }
|
||||
public static Request Get(String p0) { return null; }
|
||||
public static Request Get(URI p0) { return null; }
|
||||
public static Request Head(String p0) { return null; }
|
||||
public static Request Head(URI p0) { return null; }
|
||||
public static Request Options(String p0) { return null; }
|
||||
public static Request Options(URI p0) { return null; }
|
||||
public static Request Patch(String p0) { return null; }
|
||||
public static Request Patch(URI p0) { return null; }
|
||||
public static Request Post(String p0) { return null; }
|
||||
public static Request Post(URI p0) { return null; }
|
||||
public static Request Put(String p0) { return null; }
|
||||
public static Request Put(URI p0) { return null; }
|
||||
public static Request Trace(String p0) { return null; }
|
||||
public static Request Trace(URI p0) { return null; }
|
||||
}
|
||||
Reference in New Issue
Block a user